linux-kernel - Re: [PATCH] rtw89: Fix crash by loading compressed firmware file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87zgqjqaae.fsf@codeaurora.org>
Date:   Fri, 05 Nov 2021 10:25:13 +0200
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Takashi Iwai <tiwai@...e.de>
Cc:     Ping-Ke Shih <pkshih@...ltek.com>, linux-wireless@...r.kernel.org,
        linux-kernel@...r.kernel.org, Larry Finger <Larry.Finger@...il.com>
Subject: Re: [PATCH] rtw89: Fix crash by loading compressed firmware file

Takashi Iwai <tiwai@...e.de> writes:

> On Fri, 05 Nov 2021 08:17:25 +0100,
> Takashi Iwai wrote:
>> 
>> When a firmware is loaded in the compressed format or via user-mode
>> helper, it's mapped in read-only, and the rtw89 driver crashes at
>> rtw89_fw_download() when it tries to modify some data.
>> 
>> This patch is an attemp to avoid the crash by re-allocating the data
>> via vmalloc() for the data modification.
>
> Alternatively, we may drop the code that modifies the loaded firmware
> data?  At least SET_FW_HDR_PART_SIZE() in rtw89_fw_hdr_parser() looks
> writing it, and I have no idea why this overwrite is needed.

Strange, isn't the firmware data marked as const just to avoid this kind
of problem? Does rtw89 have wrong casts somewhere which removes the
const?

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches